let's use /tmp/some/path
as an example. You create /tmp/some
and /tmp/some/path
as e.g. root, and change permissions on /tmp/some/path
to allow write for everyone:
merlin@uc-s4m75657:~$ sudo mkdir -p /tmp/some/path
merlin@uc-s4m75657:~$ sudo chmod 0777 /tmp/some/path
merlin@uc-s4m75657:~$ ls -l /tmp/some/
итого 4
drwxrwxrwx 2 root root 4096 июл 28 11:17 path
merlin@uc-s4m75657:~$ ls -l /tmp/some/path/
итого 0
merlin@uc-s4m75657:~$ rm -rf /tmp/some/path
rm: невозможно удалить '/tmp/some/path': Отказано в доступе
(my locale is russian; "итого" means "total", "Отказано в доступе" is "Access denied")
That's all. Let's check. Since everything is owned by the root, ordinary user can't do anything with /tmp/some
, including renaming or removal of /tmp/some/path
, because it's path
item of /tmp/some
directory where this user isn't given any access besides read and list.
However, user is allowed to create items under /tmp/some/path
because we given the permission to do it:
merlin@uc-s4m75657:~$ mkdir /tmp/some/path/1
merlin@uc-s4m75657:~$ touch /tmp/some/path/2
merlin@uc-s4m75657:~$ ls -la /tmp/some/path
итого 12
drwxrwxrwx 3 root root 4096 июл 28 11:18 .
drwxr-xr-x 3 root root 4096 июл 28 11:17 ..
drwxr-xr-x 2 merlin merlin 4096 июл 28 11:18 1
-rw-r--r-- 1 merlin merlin 0 июл 28 11:18 2
merlin@uc-s4m75657:~$ mv /tmp/some/path/1 /tmp/some/path/3
merlin@uc-s4m75657:~$ ls -la /tmp/some/path
итого 12
drwxrwxrwx 3 root root 4096 июл 28 11:19 .
drwxr-xr-x 3 root root 4096 июл 28 11:17 ..
-rw-r--r-- 1 merlin merlin 0 июл 28 11:18 2
drwxr-xr-x 2 merlin merlin 4096 июл 28 11:18 3
Unfortunately, you can't really set distinct "create", "rename" and "remove" permissions on objects in Linux filesystems. This is the property of all POSIX-compartible filesystems actually, even if you try to use POSIX ACL. Users who created objects will be their respective owners, and will be able to do anything while the permissions on /tmp/some/path
allow them to write to that directory. Creation, removal and renaming are all controlled by a single flag both in traditional Unix modes and in POSIX ACL.
So allowing to create items but preventing their subsequent removal is impossible in Linux. This is one of the few places where POSIX standard completely sucks and Windows has much more versatile permission system.
chmod 777 Folder;chattr +a Folder
as root is the closest I think, expect users can modify files and do whatever they want in subfolders.